@mearl/client 2.22.0 → 3.0.0-beta.1

package/dist/commands.js

@@ -1,4 +1,4 @@
-import { APP_PROFILE_NAMES, BROWSER_DEVICE_PRESET_NAMES, } from './generated/browser-action-protocol.js';
+import { APP_PROFILE_NAMES, BROWSER_DEVICE_PRESET_NAMES, } from '@mearl/browser-core';
 /** 容器档案名列表（拼进参数说明，新增档案无需改本文件） */
 const APP_PROFILE_NAME_LIST = APP_PROFILE_NAMES.join('/');
 const DEVICE_PRESET_TYPE = BROWSER_DEVICE_PRESET_NAMES.map(name => JSON.stringify(name)).join(' | ');
@@ -298,6 +298,7 @@ export const COMMANDS = [
         ],
         notes: [
             '扩展模式规则持久化；CDP 仅支持会话级 modifyHeaders 请求头 set，不支持响应头、initiatorDomains 或其他动作。Provider 是否支持以其能力声明为准。',
+            '扩展模式会检查规则请求 URL 和显式来源域名的访问权限；缺失时仍保存规则，返回 warnings 和 missingOrigins，不自动弹窗。可在请求规则页面授权，或按提示调用 request_domain_permission。复杂 URL 表达式无法完整推断域名时会提示手动检查。',
         ],
         examples: [
             `set_rule --payload '{"actionType":"block","filter":"^https://example\\\\.com/ads/.*"}'`,
@@ -348,10 +349,10 @@ export const COMMANDS = [
             { name: 'timeout', type: 'number', description: '超时毫秒数，默认 30000' },
         ],
         notes: [
-            '仅用于非 BUC 请求；BUC 接口使用 mearl buc，不手工传 Token、DPoP 或 Ticket。',
+            '需要托管认证的接口使用相应能力插件；不要手工传入其管理的凭据。',
             'body 不能与 formData/files 组合；bodyFile 以原始字节发送，不包 multipart boundary，不能用于 GET/HEAD。',
             'bodyFile.filePath 属于 native-host，最大 40 MiB；base64 解码后最大 7 MiB。multipart 不手工设置 Content-Type，由 Mearl 生成 boundary。',
-            'filePath 属于 native-host 所在机器；无法引用远端路径时用 base64。BUC 上传的路径属于插件执行宿主。',
+            'filePath 属于请求执行宿主；无法引用远端路径时用 base64。',
         ],
         result: [
             '返回 status、statusText、headers、body、bodyType、attachedCookieCount；bodyType 为 json/text/base64，二进制 body 需解码后保存。',
@@ -459,8 +460,8 @@ export const COMMANDS = [
             { name: 'executablePath', type: 'string', description: '自定义 Chrome 可执行文件路径' },
             {
                 name: 'copyCookieDomains',
-                type: 'string[] | "mearl-services" | { presets?: ["mearl-services"]; domains?: string[] }',
-                description: '从控制浏览器复制 Cookie：可传域名数组、Mearl 登录态预设，或组合预设与额外域名',
+                type: 'string[] | string | { presets?: string[]; domains?: string[] }',
+                description: '从控制浏览器复制 Cookie：可传域名数组、已安装能力提供的范围名，或组合范围与额外域名',
             },
         ],
         examples: [
@@ -540,7 +541,7 @@ export const COMMANDS = [
             {
                 name: 'appProfile',
                 type: 'string',
-                description: '开 tab 即注入 App 客户端环境与 JSBridge；档案名同 set_app_profile，如 "fliggy"。需要 iframe WebView 和系统栏时同时传 emulation.deviceShell=true',
+                description: '按已安装档案应用 App 环境；内置基础档案只提供 UA/版本，完整桥由能力包提供。需要 iframe WebView 和系统栏时同时传 emulation.deviceShell=true',
             },
             {
                 name: 'os',
@@ -566,8 +567,8 @@ export const COMMANDS = [
             `tab_open --payload '{"url":"https://example.com"}'`,
             `tab_open --payload '{"url":"https://example.com/page","reuse":"prefer","match":{"ignoreSearch":true}}'`,
             `tab_open --payload '{"url":"https://m.example.com","emulation":{"preset":"iphone-17-pro"}}'`,
-            `tab_open --payload '{"url":"https://market.m.taobao.com/app/trip/rx-home/pages/home","appProfile":"fliggy"}'`,
-            `tab_open --payload '{"url":"https://market.m.taobao.com/app/trip/rx-home/pages/home","appProfile":"fliggy","emulation":{"preset":"ipad-mini-a17-pro","orientation":"landscape","deviceShell":true,"splitScreen":true}}'`,
+            `tab_open --payload '{"url":"https://example.com/app/home","appProfile":"fliggy"}'`,
+            `tab_open --payload '{"url":"https://example.com/app/home","appProfile":"fliggy","emulation":{"preset":"ipad-mini-a17-pro","orientation":"landscape","deviceShell":true,"splitScreen":true}}'`,
             `tab_open --payload '{"url":"https://example.com","appProfile":"fliggy","os":"android"}'`,
             `tab_open --payload '{"url":"https://example.com","group":"验证任务"}'`,
         ],
@@ -1166,7 +1167,7 @@ export const COMMANDS = [
     },
     {
         name: 'set_app_profile',
-        description: '设置 App 客户端环境与 JSBridge；可同时设置 MTop 页面接口环境，传 emulation 时联动设备模拟',
+        description: '设置已安装的 App 档案；完整 JSBridge 由能力包提供。可同时设置 MTop 页面接口环境，传 emulation 时联动设备模拟',
         summary: '设置或清除目标标签页的 App 容器模拟',
         params: [
             { name: 'enabled', type: 'boolean', required: true, description: 'true=启用，false=清除' },
@@ -1200,7 +1201,7 @@ export const COMMANDS = [
             {
                 name: 'mtopEnv',
                 type: '"default" | "prod" | "pre"',
-                description: '可选 MTop 页面接口环境；default 关闭环境改写，省略时保持当前设置。扩展模式全局生效，CDP 模式仅作用于目标 tab',
+                description: '可选 MTop 页面接口环境；default 关闭环境改写，省略时保持当前设置。仅作用于目标 tab',
             },
             {
                 name: 'emulation',
@@ -1280,8 +1281,8 @@ export const COMMANDS = [
         examples: [
             `get_cookie --payload '{"tabId":12345,"name":"feature_flag"}'`,
             `get_cookie --payload '{"url":"https://www.taobao.com/","name":"tracknick"}'`,
-            `get_cookie --payload '{"tabId":12345,"name":"edith_switch_br.rx-vehicle-search_home","domain":"taobao.com"}'`,
-            `get_cookie --payload '{"tabId":12345,"name":"tracknick","url":"https://www.taobao.com/","domain":"taobao.com","path":"/"}'`,
+            `get_cookie --payload '{"tabId":12345,"name":"feature_channel","domain":"example.com"}'`,
+            `get_cookie --payload '{"tabId":12345,"name":"tracknick","url":"https://www.taobao.com/","domain":"example.com","path":"/"}'`,
         ],
     },
     {
@@ -1327,7 +1328,7 @@ export const COMMANDS = [
         examples: [
             `set_cookie --payload '{"tabId":12345,"name":"feature_flag","value":"enabled"}'`,
             `set_cookie --payload '{"url":"https://www.taobao.com/","name":"feature_flag","value":"enabled"}'`,
-            `set_cookie --payload '{"tabId":12345,"name":"edith_switch_br.rx-vehicle-search_home","value":"3.6.63","domain":"taobao.com","reload":true}'`,
+            `set_cookie --payload '{"tabId":12345,"name":"feature_channel","value":"3.6.63","domain":"example.com","reload":true}'`,
         ],
     },
     // ── 其他 ──────────────────────────────────────────────────────────────────
@@ -1352,7 +1353,7 @@ export const COMMANDS = [
             },
         ],
         notes: [
-            'domain 使用纯主机名，不传 URL。仅在非 BUC send_request 报域权限缺失时申请，BUC 不使用浏览器域权限。',
+            'domain 使用纯主机名，不传 URL。在 send_request 或 set_rule 提示缺少浏览器域名权限时申请。',
             '弹窗等待用户选择，90 秒超时或关闭按拒绝处理；granted=true 后才重试原请求。',
         ],
         result: ['返回 granted、domain，授权成功时包含 origin。'],

package/dist/index.d.ts

@@ -12,10 +12,10 @@ export { executeRegisteredPlugin, type PluginExecutorOptions, type PluginExecuto
 export { UnifiedClient, UnifiedClient as MearlClient, decodeBrowserTarget, invoke, invokePlugin, listCloudConnectors, } from './unified.js';
 export type { UnifiedClientOptions, UnifiedInvokeOptions, UnifiedInvokeOptions as InvokeOptions, } from './unified.js';
 export type { PluginInvocation, PluginInvokeOptions, PluginProgress, StructuredPluginProgress, } from './plugins/sdk/plugin.js';
-export { APP_PROFILE_NAMES, BROWSER_DEVICE_PRESET_NAMES, BROWSER_ACTIONS, BROWSER_CAPABILITY_ACTIONS, BROWSER_COMMAND_ACTIONS, EXTENSION_BROWSER_ACTIONS, PAGE_ACT_ACTIONS, SEND_REQUEST_MAX_FILES, SEND_REQUEST_MAX_TOTAL_BASE64_FILE_BYTES, SEND_REQUEST_MAX_TOTAL_FILE_BYTES, isBrowserAction, isBrowserCapabilityAction, isBrowserCommandAction, isExtensionBrowserAction, } from './generated/browser-action-protocol.js';
-export type { ActionStep, AppProfileName, BrowserAction, BrowserActionMap, BrowserActionRequest, BrowserActionResponse, BrowserCapabilities, BrowserCapabilityAction, BrowserCloseParams, BrowserCommandAction, BrowserInfo, BrowserInfoBase, BrowserJsonValue, BrowserLaunchParams, BrowserProviderOperation, BrowserListResult, BrowserPairingInfo, BrowserReleaseFailure, BrowserReleaseResult, BrowserProviderDefinition, BrowserProviderIdentity, BrowserProviderInputSchema, BrowserProviderListResult, BrowserReference, BrowserDetails, BrowserSource, BrowserStatus, BrowserScreenshotKind, BrowserTransport, CaptureCheckpointParams, CaptureCheckpointResult, BrowserDevicePresetName, BrowserEmulationOptions, ExtensionBrowserAction, GetCookieParams, GetCookieResult, GetEventsParams, GetLogsParams, GetMocksParams, GetRequestsParams, ManagedBrowserInfo, PageClickParams, PageDragEndpoint, PageDragParams, PageDragPoint, PageActAction, PageDiagnosticsOptions, PageDiagnosticsSetting, PageEvalParams, PageFramesParams, PageHoverParams, PageInspectFilter, PageInspectParams, PageNavigateParams, PageObservationWaitOptions, PagePressParams, PageScreenshotParams, PageScrollParams, PageSnapshotParams, PageSnapshotQuery, PageTypeParams, PageUploadParams, PageWaitParams, RegularBrowserInfo, RequestDomainPermissionParams, RulesResult, RunActionName, RunActionsParams, SelectBrowserParams, SelectBrowserResult, SendRequestFile, SendRequestBinaryBody, SendRequestFormValue, SendMtopRequestParams, SendRequestParams, SetAppProfileParams, SetCookieParams, SetCookieResult, SetDeviceEmulationParams, SetMockParams, SetRuleParams, SetTimezoneParams, SetTimezoneResult, TabCloseParams, TabOpenParams, } from './generated/browser-action-protocol.js';
+export { APP_PROFILE_NAMES, BROWSER_DEVICE_PRESET_NAMES, BROWSER_ACTIONS, BROWSER_CAPABILITY_ACTIONS, BROWSER_COMMAND_ACTIONS, EXTENSION_BROWSER_ACTIONS, PAGE_ACT_ACTIONS, SEND_REQUEST_MAX_FILES, SEND_REQUEST_MAX_TOTAL_BASE64_FILE_BYTES, SEND_REQUEST_MAX_TOTAL_FILE_BYTES, isBrowserAction, isBrowserCapabilityAction, isBrowserCommandAction, isExtensionBrowserAction, } from '@mearl/browser-core';
+export type { ActionStep, AppProfileName, BrowserAction, BrowserActionMap, BrowserActionRequest, BrowserActionResponse, BrowserCapabilities, BrowserCapabilityAction, BrowserCloseParams, BrowserCommandAction, BrowserInfo, BrowserInfoBase, BrowserJsonValue, BrowserLaunchParams, BrowserProviderOperation, BrowserListResult, BrowserPairingInfo, BrowserReleaseFailure, BrowserReleaseResult, BrowserProviderDefinition, BrowserProviderIdentity, BrowserProviderInputSchema, BrowserProviderListResult, BrowserReference, BrowserDetails, BrowserSource, BrowserStatus, BrowserScreenshotKind, BrowserTransport, CaptureCheckpointParams, CaptureCheckpointResult, BrowserDevicePresetName, BrowserEmulationOptions, ExtensionBrowserAction, GetCookieParams, GetCookieResult, GetEventsParams, GetLogsParams, GetMocksParams, GetRequestsParams, ManagedBrowserInfo, PageClickParams, PageDragEndpoint, PageDragParams, PageDragPoint, PageActAction, PageDiagnosticsOptions, PageDiagnosticsSetting, PageEvalParams, PageFramesParams, PageHoverParams, PageInspectFilter, PageInspectParams, PageNavigateParams, PageObservationWaitOptions, PagePressParams, PageScreenshotParams, PageScrollParams, PageSnapshotParams, PageSnapshotQuery, PageTypeParams, PageUploadParams, PageWaitParams, RegularBrowserInfo, RequestDomainPermissionParams, RulesResult, RunActionName, RunActionsParams, SelectBrowserParams, SelectBrowserResult, SendRequestFile, SendRequestBinaryBody, SendRequestFormValue, SendMtopRequestParams, SendRequestParams, SetAppProfileParams, SetCookieParams, SetCookieResult, SetDeviceEmulationParams, SetMockParams, SetRuleParams, SetTimezoneParams, SetTimezoneResult, TabCloseParams, TabOpenParams, } from '@mearl/browser-core';
 import { type UnifiedInvokeOptions } from './unified.js';
-import type * as Protocol from './generated/browser-action-protocol.js';
+import type * as Protocol from '@mearl/browser-core';
 export declare function tabCheckpoint(params: Protocol.CaptureCheckpointParams, options?: UnifiedInvokeOptions): Promise<Protocol.BrowserActionResponse<'tab_checkpoint'>>;
 /** Compatibility wrapper for tabCheckpoint. */
 export declare function captureCheckpoint(params: Protocol.CaptureCheckpointParams, options?: UnifiedInvokeOptions): Promise<Protocol.BrowserActionResponse<'tab_checkpoint'>>;
@@ -68,7 +68,4 @@ export declare function saveArtifact(artifact: Protocol.BrowserArtifact & {
 }>;
 export { PluginStateClient } from './plugins/clients/pluginState.js';
 export { PluginModelClient } from './plugins/clients/pluginModels.js';
-export type * from './generated/plugin-state.js';
-export type * from './generated/plugin-models.js';
-export type * from './generated/plugin-recovery.js';
-export type * from './generated/plugin-diagnostics.js';
+export type * from '@mearl/browser-core';

package/dist/index.js

@@ -9,7 +9,7 @@ export { PluginTaskClient, } from './plugins/clients/pluginTasks.js';
 export { PluginPageClient } from './plugins/clients/pluginPages.js';
 export { executeRegisteredPlugin, } from './plugins/sdk/plugin.js';
 export { UnifiedClient, UnifiedClient as MearlClient, decodeBrowserTarget, invoke, invokePlugin, listCloudConnectors, } from './unified.js';
-export { APP_PROFILE_NAMES, BROWSER_DEVICE_PRESET_NAMES, BROWSER_ACTIONS, BROWSER_CAPABILITY_ACTIONS, BROWSER_COMMAND_ACTIONS, EXTENSION_BROWSER_ACTIONS, PAGE_ACT_ACTIONS, SEND_REQUEST_MAX_FILES, SEND_REQUEST_MAX_TOTAL_BASE64_FILE_BYTES, SEND_REQUEST_MAX_TOTAL_FILE_BYTES, isBrowserAction, isBrowserCapabilityAction, isBrowserCommandAction, isExtensionBrowserAction, } from './generated/browser-action-protocol.js';
+export { APP_PROFILE_NAMES, BROWSER_DEVICE_PRESET_NAMES, BROWSER_ACTIONS, BROWSER_CAPABILITY_ACTIONS, BROWSER_COMMAND_ACTIONS, EXTENSION_BROWSER_ACTIONS, PAGE_ACT_ACTIONS, SEND_REQUEST_MAX_FILES, SEND_REQUEST_MAX_TOTAL_BASE64_FILE_BYTES, SEND_REQUEST_MAX_TOTAL_FILE_BYTES, isBrowserAction, isBrowserCapabilityAction, isBrowserCommandAction, isExtensionBrowserAction, } from '@mearl/browser-core';
 import { invoke } from './unified.js';
 export function tabCheckpoint(params, options) {
     return invoke('tab_checkpoint', params, options);

package/dist/local.d.ts

@@ -3,5 +3,7 @@
  * User-facing integrations should import from `@mearl/client` so browser routing
  * remains consistent across local and remote sources.
  */
-export { CLIENT_VERSION, SOCKET_PATH, decorateBrowserListResult, getDefaultBrowser, invoke, setDefaultBrowser, } from './socket.js';
+export { CLIENT_VERSION, SOCKET_PATH, decorateBrowserListResult, getDefaultBrowser, invoke, invokeLocalHost, setDefaultBrowser, } from './socket.js';
 export type { InvokeOptions } from './socket.js';
+export { listLiveBrowsers } from './browserRegistry.js';
+export type { LiveBrowser } from './browserRegistry.js';

package/dist/local.js

@@ -3,4 +3,5 @@
  * User-facing integrations should import from `@mearl/client` so browser routing
  * remains consistent across local and remote sources.
  */
-export { CLIENT_VERSION, SOCKET_PATH, decorateBrowserListResult, getDefaultBrowser, invoke, setDefaultBrowser, } from './socket.js';
+export { CLIENT_VERSION, SOCKET_PATH, decorateBrowserListResult, getDefaultBrowser, invoke, invokeLocalHost, setDefaultBrowser, } from './socket.js';
+export { listLiveBrowsers } from './browserRegistry.js';

package/dist/nativeHost.d.ts

@@ -1,5 +1,5 @@
-export type NativeHostIntegrationMode = 'skills' | 'mcp';
-export declare const MEARL_NATIVE_HOST_NAMES: Record<NativeHostIntegrationMode, string>;
+import { MEARL_NATIVE_HOST_NAMES, type NativeHostIntegrationMode } from '@mearl/browser-core';
+export { MEARL_NATIVE_HOST_NAMES, type NativeHostIntegrationMode };
 export interface NativeHostDirectoryOptions {
     env?: NodeJS.ProcessEnv;
     homedir?: () => string;

package/dist/nativeHost.js

@@ -1,10 +1,8 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-export const MEARL_NATIVE_HOST_NAMES = {
-    skills: 'com.alibaba.mearl.skills',
-    mcp: 'com.alibaba.mearl.mcp',
-};
+import { MEARL_NATIVE_HOST_NAMES } from '@mearl/browser-core';
+export { MEARL_NATIVE_HOST_NAMES };
 export function resolveNativeHostDirectory(options = {}) {
     const env = options.env ?? process.env;
     const home = (options.homedir ?? os.homedir)();

package/dist/pageEvalArguments.d.ts

@@ -1,3 +1,3 @@
-import { type PageEvalParams } from './generated/browser-action-protocol.js';
+import { type PageEvalParams } from '@mearl/browser-core';
 /** Serialize page_eval arguments within transport limits while retaining the caller's execution world. */
 export declare function invokePageEvalWithArgs(invoke: (payload: Record<string, unknown>, transfer?: boolean) => Promise<any>, params: PageEvalParams): Promise<any>;

package/dist/pageEvalArguments.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { validatePageUserScriptParams, resolvePageEvalExpression, } from './generated/browser-action-protocol.js';
+import { validatePageUserScriptParams, resolvePageEvalExpression, } from '@mearl/browser-core';
 const CHUNK_CHARACTERS = 48 * 1024;
 /** Serialize page_eval arguments within transport limits while retaining the caller's execution world. */
 export async function invokePageEvalWithArgs(invoke, params) {

package/dist/plugin.d.ts

@@ -1 +1,2 @@
 export * from './plugins/sdk/plugin.js';
+export * from './plugins/skillManifest.js';

package/dist/plugin.js

@@ -1 +1,2 @@
 export * from './plugins/sdk/plugin.js';
+export * from './plugins/skillManifest.js';

package/dist/pluginModelSessionWorker.d.ts

@@ -1,5 +1,5 @@
-import type { PluginModelDiagnostic, PluginModelRequest, PluginModelResult } from './generated/plugin-models.js';
-import type { PluginExecutionError } from './generated/plugin-execution.js';
+import type { PluginModelDiagnostic, PluginModelRequest, PluginModelResult } from '@mearl/browser-core';
+import type { PluginExecutionError } from '@mearl/browser-core';
 export type ModelSessionRequest = {
     request: PluginModelRequest;
 };

package/dist/plugins/clients/pluginHostConnection.d.ts

@@ -1,4 +1,4 @@
-import type { PluginInvocationSource, PluginExecutionHost } from '../../generated/plugin-execution.js';
+import type { PluginInvocationSource, PluginExecutionHost } from '@mearl/browser-core';
 import type { PluginExecutionContext } from '../sdk/plugin.js';
 export interface PluginHostConnectionOptions {
     source?: PluginInvocationSource;

package/dist/plugins/clients/pluginHostConnection.js

@@ -4,7 +4,7 @@ import { createConnection } from 'node:net';
 import { PLUGIN_TASK_HOST_PATH } from '../../runtimePaths.js';
 import { claimRecord, isProcessOwnerAlive, processIdentity, readRecord, removeInvalidRecord, removeRecordIfPid, rotateLogIfNeeded, } from '@mearl/daemon-core';
 import { pluginHostPaths } from '../runtime/pluginHostPaths.js';
-import { PLUGIN_TASK_PROTOCOL_VERSION } from '../../generated/plugin-tasks.js';
+import { PLUGIN_TASK_PROTOCOL_VERSION } from '@mearl/browser-core';
 import { readPluginTaskMessages, writePluginTaskMessage } from '../pluginTaskWire.js';
 import { pluginExecutionError, serializePluginExecutionError, } from '../runtime/pluginExecutorProtocol.js';
 const starting = new Map();

package/dist/plugins/clients/pluginModels.d.ts

@@ -1,9 +1,9 @@
 import type { PluginHostClientOptions } from './pluginHostConnection.js';
 import { PluginTaskClient } from './pluginTasks.js';
 import type { PluginTaskStartOptions, PluginTaskWaitOptions } from './pluginTasks.js';
-import type { PluginModelRequest, PluginModelResult, PluginModelCapability, PluginModelList } from '../../generated/plugin-models.js';
-import type { PluginTaskStartResult } from '../../generated/plugin-tasks.js';
-export type * from '../../generated/plugin-models.js';
+import type { PluginModelRequest, PluginModelResult, PluginModelCapability, PluginModelList } from '@mearl/browser-core';
+import type { PluginTaskStartResult } from '@mearl/browser-core';
+export type * from '@mearl/browser-core';
 export declare class PluginModelClient {
     readonly tasks: PluginTaskClient;
     constructor(options?: PluginHostClientOptions);

package/dist/plugins/clients/pluginPages.d.ts

@@ -1,7 +1,7 @@
 import type { PluginHostConnection } from './pluginHostConnection.js';
 import type { UnifiedClientOptions, UnifiedInvokeOptions } from '../../unified.js';
-import type { PluginPageInstance, PluginPageEvents, PluginPageOperation } from '../../generated/plugin-pages.js';
-export type { PluginPageInstance, PluginPageEvents, PluginPageRuntime, PluginPageActivation, PluginPageTarget, PluginPageOperation, } from '../../generated/plugin-pages.js';
+import type { PluginPageInstance, PluginPageEvents, PluginPageOperation } from '@mearl/browser-core';
+export type { PluginPageInstance, PluginPageEvents, PluginPageRuntime, PluginPageActivation, PluginPageTarget, PluginPageOperation, } from '@mearl/browser-core';
 export declare class PluginPageClient {
     private readonly connection?;
     private readonly client?;

package/dist/plugins/clients/pluginState.d.ts

@@ -1,8 +1,8 @@
 import { PluginHostConnection } from './pluginHostConnection.js';
 import type { PluginHostClientOptions } from './pluginHostConnection.js';
 import type { PluginOptions } from '../sdk/plugin.js';
-import type { PluginStateOperation, PluginStateSnapshot, PluginStateList, PluginStateTransaction } from '../../generated/plugin-state.js';
-export type * from '../../generated/plugin-state.js';
+import type { PluginStateOperation, PluginStateSnapshot, PluginStateList, PluginStateTransaction } from '@mearl/browser-core';
+export type * from '@mearl/browser-core';
 export declare class PluginStateClient {
     private readonly options;
     readonly connection: PluginHostConnection;

package/dist/plugins/clients/pluginTasks.d.ts

@@ -1,8 +1,8 @@
 import { PluginHostConnection } from './pluginHostConnection.js';
 import type { PluginHostClientOptions, HostStatus as PluginHostStatus } from './pluginHostConnection.js';
-import type { PluginTaskCheckpoint } from '../../generated/plugin-recovery.js';
-import type { PluginDiagnosticOptions, PluginDiagnosticReport } from '../../generated/plugin-diagnostics.js';
-import type { PluginTask, PluginTaskEvents, PluginTaskListResult, PluginTaskResultChunk, PluginTaskStartResult } from '../../generated/plugin-tasks.js';
+import type { PluginTaskCheckpoint } from '@mearl/browser-core';
+import type { PluginDiagnosticOptions, PluginDiagnosticReport } from '@mearl/browser-core';
+import type { PluginTask, PluginTaskEvents, PluginTaskListResult, PluginTaskResultChunk, PluginTaskStartResult } from '@mearl/browser-core';
 import type { PluginInvocation, PluginOptions } from '../sdk/plugin.js';
 export type { PluginTask, PluginTaskEvents, PluginTaskListResult, PluginTaskStartResult };
 export interface PluginTaskStartOptions extends PluginOptions {

package/dist/plugins/clients/pluginTasks.js

@@ -3,7 +3,7 @@ import { createHash } from 'node:crypto';
 import { isProcessOwnerAlive, readRecord } from '@mearl/daemon-core';
 import { pluginHostPaths } from '../runtime/pluginHostPaths.js';
 import { UnifiedClient, decodeBrowserTarget } from '../../unified.js';
-import { isPluginTaskActive } from '../../generated/plugin-tasks.js';
+import { isPluginTaskActive } from '@mearl/browser-core';
 import { pluginExecutionError } from '../runtime/pluginExecutorProtocol.js';
 function localWait(promise, signal, timeoutMs = Infinity) {
     return new Promise((resolve, reject) => {

package/dist/plugins/officialPluginCatalog.d.ts

@@ -2,27 +2,24 @@ export declare const OFFICIAL_PLUGIN_MANAGER = "@mearl/setup:official";
 export interface OfficialPluginDefinition {
     description: string;
     installArgs: readonly string[];
-    setup?: 'alibaba';
+    setup?: string;
     skill: string;
 }
-export declare const OFFICIAL_PLUGINS: {
-    readonly buc: {
-        readonly description: "使用 BUC 身份请求内部服务";
-        readonly installArgs: readonly ["trip/mearl", "--skill", "buc-request", "--yes"];
-        readonly skill: "buc-request";
-    };
-    readonly authx: {
-        readonly description: "使用 AuthX 身份请求内部服务";
-        readonly installArgs: readonly ["trip/mearl", "--skill", "authx-request", "--yes"];
-        readonly skill: "authx-request";
-    };
-    readonly tdbank: {
-        readonly description: "查询、借用和切换 TDBank 测试账号";
-        readonly installArgs: readonly ["trip/mearl", "--skill", "tdbank-account", "--yes"];
-        readonly setup: "alibaba";
-        readonly skill: "tdbank-account";
-    };
-};
-export type OfficialPluginName = keyof typeof OFFICIAL_PLUGINS;
+export type OfficialPluginName = string;
+export declare const OFFICIAL_PLUGINS: Record<string, OfficialPluginDefinition>;
+export interface PluginCatalogSelection {
+    path: string;
+    sha256: string;
+}
+export interface PluginCatalog {
+    schemaVersion: 1;
+    revision: string;
+    plugins: Record<string, OfficialPluginDefinition>;
+    selection?: PluginCatalogSelection;
+}
+export declare function validateOfficialPluginCatalog(value: unknown): PluginCatalog;
+export declare function readOfficialPluginCatalog(): PluginCatalog | undefined;
+/** Installation hosts persist only the catalog selected by an approved preset. */
+export declare function replaceOfficialPluginCatalog(revision: string, plugins: Record<string, OfficialPluginDefinition>, selection?: PluginCatalogSelection): void;
 export declare function findOfficialPlugin(name: string): OfficialPluginDefinition | undefined;
-export declare function listOfficialPluginNames(setup?: OfficialPluginDefinition['setup']): string[];
+export declare function listOfficialPluginNames(setup?: string): string[];

package/dist/plugins/officialPluginCatalog.js

@@ -1,29 +1,125 @@
+import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { isAbsolute, join } from 'node:path';
+import { assertPluginName, pluginDirectory } from './pluginRegistry.js';
 export const OFFICIAL_PLUGIN_MANAGER = '@mearl/setup:official';
-export const OFFICIAL_PLUGINS = {
-    buc: {
-        description: '使用 BUC 身份请求内部服务',
-        installArgs: ['trip/mearl', '--skill', 'buc-request', '--yes'],
-        skill: 'buc-request',
-    },
-    authx: {
-        description: '使用 AuthX 身份请求内部服务',
-        installArgs: ['trip/mearl', '--skill', 'authx-request', '--yes'],
-        skill: 'authx-request',
-    },
-    tdbank: {
-        description: '查询、借用和切换 TDBank 测试账号',
-        installArgs: ['trip/mearl', '--skill', 'tdbank-account', '--yes'],
-        setup: 'alibaba',
-        skill: 'tdbank-account',
-    },
-};
+export const OFFICIAL_PLUGINS = {};
+const MAX_CATALOG_BYTES = 256 * 1024;
+const catalogPath = () => join(pluginDirectory(), '.official-catalog.json');
+export function validateOfficialPluginCatalog(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Invalid managed plugin catalog');
+    const input = value;
+    if (input.schemaVersion !== 1 || typeof input.revision !== 'string' || !/^[a-f0-9]{64}$/.test(input.revision) ||
+        !input.plugins || typeof input.plugins !== 'object' || Array.isArray(input.plugins) ||
+        Object.keys(input).some(key => !['schemaVersion', 'revision', 'plugins', 'selection'].includes(key)) || Object.keys(input.plugins).length > 200)
+        throw new Error('Invalid managed plugin catalog');
+    const selection = input.selection;
+    if (selection !== undefined && (!selection || typeof selection !== 'object' || Array.isArray(selection) || Object.keys(selection).some(key => !['path', 'sha256'].includes(key)) || typeof selection.path !== 'string' || !isAbsolute(selection.path) || selection.path.length > 4096 || /[\0\r\n]/.test(selection.path) || typeof selection.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(selection.sha256)))
+        throw new Error('Invalid plugin catalog selection');
+    const plugins = {};
+    for (const [name, value] of Object.entries(input.plugins)) {
+        assertPluginName(name);
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error('Invalid managed plugin declaration');
+        const item = value;
+        if (Object.keys(item).some(key => !['description', 'installArgs', 'setup', 'skill'].includes(key)) ||
+            typeof item.description !== 'string' || item.description.length > 1000 ||
+            typeof item.skill !== 'string' || !/^[a-z][a-z0-9-]*$/.test(item.skill) ||
+            !Array.isArray(item.installArgs) || item.installArgs.length === 0 || item.installArgs.length > 32 ||
+            item.installArgs.some(arg => typeof arg !== 'string' || arg.length > 2048 || /[\0\r\n]/.test(arg)) ||
+            (item.setup !== undefined && (typeof item.setup !== 'string' || !/^[a-z][a-z0-9-]*$/.test(item.setup))))
+            throw new Error('Invalid managed plugin declaration');
+        plugins[name] = { description: item.description, skill: item.skill, installArgs: [...item.installArgs], ...(item.setup !== undefined && { setup: item.setup }) };
+    }
+    const catalog = { schemaVersion: 1, revision: input.revision, plugins, ...(selection ? { selection: { path: selection.path, sha256: selection.sha256 } } : {}) };
+    if (Buffer.byteLength(JSON.stringify(catalog)) > MAX_CATALOG_BYTES)
+        throw new Error('Managed plugin catalog exceeds 256 KiB');
+    return catalog;
+}
+function selectionMatches(selection) {
+    try {
+        const before = lstatSync(selection.path);
+        if (!before.isFile() || before.isSymbolicLink() || before.size > 1024 * 1024)
+            return false;
+        const fd = openSync(selection.path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        try {
+            const stat = fstatSync(fd);
+            if (!stat.isFile() || stat.size > 1024 * 1024)
+                return false;
+            const bytes = Buffer.alloc(stat.size + 1);
+            let size = 0;
+            while (size < bytes.length) {
+                const count = readSync(fd, bytes, size, bytes.length - size, null);
+                if (!count)
+                    break;
+                size += count;
+            }
+            return size === stat.size && createHash('sha256').update(bytes.subarray(0, size)).digest('hex') === selection.sha256;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+export function readOfficialPluginCatalog() {
+    let source;
+    try {
+        source = readFileSync(catalogPath(), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    if (Buffer.byteLength(source) > MAX_CATALOG_BYTES)
+        throw new Error('Managed plugin catalog exceeds 256 KiB');
+    const catalog = validateOfficialPluginCatalog(JSON.parse(source));
+    return catalog.selection && !selectionMatches(catalog.selection) ? undefined : catalog;
+}
+/** Installation hosts persist only the catalog selected by an approved preset. */
+export function replaceOfficialPluginCatalog(revision, plugins, selection) {
+    const catalog = validateOfficialPluginCatalog({ schemaVersion: 1, revision, plugins, ...(selection ? { selection } : {}) });
+    const content = JSON.stringify(catalog);
+    if (Buffer.byteLength(content) > MAX_CATALOG_BYTES)
+        throw new Error('Managed plugin catalog exceeds 256 KiB');
+    if (catalog.selection && !selectionMatches(catalog.selection))
+        throw new Error('PLUGIN_CATALOG_SELECTION_CHANGED');
+    mkdirSync(pluginDirectory(), { recursive: true, mode: 0o700 });
+    const file = catalogPath();
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, content, { mode: 0o600, flag: 'wx' });
+        if (catalog.selection && !selectionMatches(catalog.selection))
+            throw new Error('PLUGIN_CATALOG_SELECTION_CHANGED');
+        renameSync(temporary, file);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+    refreshOfficialPlugins();
+}
+function refreshOfficialPlugins() {
+    let plugins = {};
+    try {
+        plugins = readOfficialPluginCatalog()?.plugins ?? {};
+    }
+    catch { /* An invalid optional catalog cannot disable registered plugin or browser commands. */ }
+    for (const name of Object.keys(OFFICIAL_PLUGINS))
+        delete OFFICIAL_PLUGINS[name];
+    Object.assign(OFFICIAL_PLUGINS, plugins);
+    return OFFICIAL_PLUGINS;
+}
+refreshOfficialPlugins();
 export function findOfficialPlugin(name) {
-    return Object.hasOwn(OFFICIAL_PLUGINS, name)
-        ? OFFICIAL_PLUGINS[name]
-        : undefined;
+    const plugins = refreshOfficialPlugins();
+    return Object.hasOwn(plugins, name) ? plugins[name] : undefined;
 }
 export function listOfficialPluginNames(setup) {
-    return Object.entries(OFFICIAL_PLUGINS)
-        .filter(([, definition]) => setup === undefined || ('setup' in definition && definition.setup === setup))
-        .map(([name]) => name);
+    return Object.entries(refreshOfficialPlugins()).filter(([, item]) => setup === undefined || item.setup === setup).map(([name]) => name);
 }

package/dist/plugins/officialPluginInstaller.js

@@ -2,7 +2,7 @@ import { closeSync, mkdirSync, openSync, rmSync, statSync, writeFileSync } from
 import { CLIENT_VERSION } from '../runtimePaths.js';
 import { join } from 'node:path';
 import { spawn } from 'node:child_process';
-import { findOfficialPlugin } from './officialPluginCatalog.js';
+import { findOfficialPlugin, readOfficialPluginCatalog } from './officialPluginCatalog.js';
 import { findPluginRegistration, pluginDirectory } from './pluginRegistry.js';
 const INSTALL_TIMEOUT_MS = 180_000;
 const INSTALL_LOCK_STALE_MS = 5 * 60_000;
@@ -105,8 +105,13 @@ async function installOfficialPlugin(name, progress) {
     try {
         if (findPluginRegistration(name))
             return;
+        const accepted = JSON.stringify(readOfficialPluginCatalog());
+        if (!findOfficialPlugin(name))
+            throw new Error('PLUGIN_CATALOG_SELECTION_CHANGED');
         progress?.(`正在安装官方插件 ${name}...`);
         await installWithSetup(name);
+        if (JSON.stringify(readOfficialPluginCatalog()) !== accepted)
+            throw new Error('PLUGIN_CATALOG_SELECTION_CHANGED');
         if (!findPluginRegistration(name)) {
             throw new Error(`官方插件 ${name} 安装完成后仍未注册`);
         }

package/dist/plugins/pluginRegistry.d.ts

@@ -1,4 +1,4 @@
-import { type AppProfileContribution } from '../generated/app-profile-definition.js';
+import { type AppProfileContribution } from '@mearl/browser-core';
 export declare class PluginError extends Error {
     readonly code: string;
     constructor(code: string, message: string);

package/dist/plugins/pluginRegistry.js

@@ -1,6 +1,6 @@
-import { validateAppProfileContribution, } from '../generated/app-profile-definition.js';
+import { validateAppProfileContribution, } from '@mearl/browser-core';
 import { randomUUID } from 'node:crypto';
-import { parseToolboxIcon } from '../generated/toolbox-icon.js';
+import { parseToolboxIcon } from '@mearl/browser-core';
 import { closeSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
 import { isAbsolute, join, resolve } from 'node:path';

package/dist/plugins/pluginTaskProtocol.d.ts

@@ -1,4 +1,4 @@
-import type { PluginExecutionError, PluginInvocationSource } from '../generated/plugin-execution.js';
+import type { PluginExecutionError, PluginInvocationSource } from '@mearl/browser-core';
 import type { PluginOptions } from './sdk/plugin.js';
 export interface PluginTaskScope {
     access: 'public' | 'toolbox' | 'runtime';

package/dist/plugins/runtime/pluginDiagnostics.d.ts

@@ -1,8 +1,8 @@
-import type { PluginModelDiagnostic } from '../../generated/plugin-models.js';
-import type { PluginDiagnosticFailure, PluginDiagnosticOptions, PluginDiagnosticPage, PluginDiagnosticPageBinding, PluginDiagnosticReport } from '../../generated/plugin-diagnostics.js';
+import type { PluginModelDiagnostic } from '@mearl/browser-core';
+import type { PluginDiagnosticFailure, PluginDiagnosticOptions, PluginDiagnosticPage, PluginDiagnosticPageBinding, PluginDiagnosticReport } from '@mearl/browser-core';
 import type { PluginTaskRecord } from './pluginTaskStore.js';
 import type { PluginTaskScope } from '../pluginTaskProtocol.js';
-import type { PluginExecutionHost } from '../../generated/plugin-execution.js';
+import type { PluginExecutionHost } from '@mearl/browser-core';
 export declare const MAX_PLUGIN_DIAGNOSTIC_BYTES: number;
 export declare function normalizeDiagnosticOptions(value: unknown): PluginDiagnosticOptions;
 export declare function diagnosticFailure(value: {

package/dist/plugins/runtime/pluginDiagnostics.js

@@ -1,7 +1,7 @@
 import { isProcessOwnerAlive } from '@mearl/daemon-core';
 import { basename } from 'node:path';
-import { isPluginTaskId, PLUGIN_TASK_PROTOCOL_VERSION } from '../../generated/plugin-tasks.js';
-import { isPluginPageInstanceId } from '../../generated/plugin-pages.js';
+import { isPluginTaskId, PLUGIN_TASK_PROTOCOL_VERSION } from '@mearl/browser-core';
+import { isPluginPageInstanceId } from '@mearl/browser-core';
 export const MAX_PLUGIN_DIAGNOSTIC_BYTES = 256 * 1024;
 function text(value, maximum = 256) {
     if (typeof value !== 'string')

package/dist/plugins/runtime/pluginExecution.d.ts

@@ -1,6 +1,6 @@
-import type { PluginExecutionHost, PluginInvocationIdentity, PluginInvocationSource } from '../../generated/plugin-execution.js';
+import type { PluginExecutionHost, PluginInvocationIdentity, PluginInvocationSource } from '@mearl/browser-core';
 import type { PluginApp } from '../sdk/plugin.js';
-import type { PluginTaskRecoveryContext } from '../../generated/plugin-recovery.js';
+import type { PluginTaskRecoveryContext } from '@mearl/browser-core';
 export type { PluginExecutionHost, PluginInvocationIdentity, PluginInvocationSource };
 export interface PluginCommandContext extends Pick<PluginApp, 'invoke' | 'progress'> {
     readonly identity: Readonly<PluginInvocationIdentity>;

package/dist/plugins/runtime/pluginExecutor.d.ts

@@ -1,4 +1,4 @@
-import type { PluginModelDiagnostic, PluginModelRequest } from '../../generated/plugin-models.js';
+import type { PluginModelDiagnostic, PluginModelRequest } from '@mearl/browser-core';
 import { type PluginRegistration } from '../pluginRegistry.js';
 import type { PluginExecutionContext, PluginInvocation, PluginInvokeOptions } from '../sdk/plugin.js';
 export interface PluginExecutorDependencies {

package/dist/plugins/runtime/pluginExecutorProtocol.d.ts

@@ -1,5 +1,5 @@
-import type { PluginModelDiagnostic, PluginModelRequest } from '../../generated/plugin-models.js';
-import type { PluginInvocationIdentity, PluginExecutionError } from '../../generated/plugin-execution.js';
+import type { PluginModelDiagnostic, PluginModelRequest } from '@mearl/browser-core';
+import type { PluginInvocationIdentity, PluginExecutionError } from '@mearl/browser-core';
 import type { PluginInvocation, PluginOptions, PluginProgress } from '../sdk/plugin.js';
 import type { PluginRegistration } from '../pluginRegistry.js';
 export type PluginWorkerRequest = {